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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1. (currently amended) An apparatus to be connected between a network access unit 
and a network to be protected, for protecting legitimate traffic from DoS (denial of service) and 
DDoS (distributed denial of service) attacks, said apparatus comprising: 

a high-priority queue; 

a low-priority queue; 

a queue information table havin g, for each specific STT (source-based traffic trunk), a 
service queue for information of a specific packet having the specific STT, wherein the service 
queue is the high-priority queue or the low-priority queue ; 

a queue coordinator for updating the queue information table based on a load of a provided 
STT and a load of the high priority queue; 

a packet classifier for receiving a packet from the network access unit, searching the queue 
information table for a investigating an STT service queue associated with an STT of the received 
packe t from the queue information table , selectively transferring the received packet to the high- 
priority queue or the low-priority queue in accordance with the service queue, an investigation 
result and providing information on the received packet to the queue coordinator ; 

a queue coordinator for receiving information on the received packet from the packet 
classifier, and updating the service queue associated with the STT of the received packet in the 
queue information table based on a load of the STT of the received packet; and 

a buffer for buffering outputs of the high-priority queue and the low-priority queue and 
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providing the buffered outputs to the network to be protected. 

2. (original) The apparatus of claim 1, wherein the network to be protected 
comprises a server. 

3. (currently amended) The apparatus of claim 1, wherein the information on the 
received packet includes a packet size, a packet arrival time and an STT index of the queue 
information table for representing the STT information of the received packet. 

4. (currently amended) The apparatus of claim 1, wherein the queue information 
table has fields including: 

an STT ID field . 

a service queue field , 

an average loa d field , 

a recent load calculation time field, and 

a total packet size field . 

5. (currently amended) The apparatus of claim 1, wherein a maximum load of both 
the high-priority queue and the low-priority queue is set to be a maximum allowable load of the 
network to be protected. 

6. (original) The apparatus of claim 5, wherein the network to be protected 
comprises a server. 

7. (currently amended) A method [[for]] of protecting legitimate traffic from DoS 
(denial of service) and DDoS (distributed denial of service) attacks in an apparatus therefor, 
wherein the by way of an apparatus which is connected between a network access unit and a 
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network to be protected an d which includes: 

a queue information table having , for each specific STT (source-based traffic trunk), a 
service queue for information of a specific packet having the specific STT, wherein the service 
queue is a high-priority queue or a low-priority queue , 

a queue coordinator^ for updating the queue information table based on a load of a provided 
STT and a load of a high priority queue and 

a packet classifies for receiving a packet from the network access unit, investigating an STT 
service queue of a received packet from the queue information table, selectively transferring the 
received packet to the high priority queue or the low priority queue in accordance with an 
investigation result and providing information on the received packet to the queue coordinator, 

the method comprising the steps of: 

(a) obtainin g, by the packet classifier, an STT (STTr) of a packet received from the 
network access unit based ID based on a source IP address of the received packet received from the 
network access unit ; 

(b) searching, by the packet classifier, the queue information table for the investigating 
a service queue corresponding to STTr the searched STT ID from the queue information table and 
checking , by the packet classifier, whether the service queue is the high-priority queue or the low- 
priority queue; 

(c) transferring , by the packet classifier, the received packet to the high-priority queue if 
the service queue is the high-priority queue in the step (b); 

(d) transferring , by the packet classifier, the received packet to the low-priority queue if 
the service queue is the low-priority queue in the step (b); [[and]] 

(e) transferring , by the packet classifier, packet information on the received packet 
information to the queue coordinato r; and 

(f) updating, by the queue coordinator and based on a load of STT g , the service queue 
associated with STTr in the queue information table . 
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8. (original) The method of claim 7, wherein the network to be protected 
comprises a server. 

9. (currently amended) The method of claim 7, wherein the step (f) comprises the 
following steps performed by the queue coordinator comprises the steps of : 

(a') calculating an average load of STTr based on an STT corresponding to the packet 
information transferred from the packet classifier; 

(b') selectively resetting the an STT service queue associated with STTr depending 
based on the calculated average load of the STT STTr ; 

(c') calculating an average load of the high-priority queue; 

(d) selectively resetting a certain STT service queue associated with a certain STT 
depending based on the calculated average load of the high-priority queue; and 

(e') storing the selectively reset service queue STT information in the queue information 

table. 

10. (currently amended) The method of claim 9, wherein the step (e') further 
comprises: 

storing modified STT information refers to a modified average load and service queue in the 
queue information table . 

11. (currently amended) The method of claim 9, wherein the step (a') further includes 
the steps of: 

(a'l) calculating a total packet size based on the packet information transferred from the 
packet classifier; 

(a'2) checking whether it is time to recalculate [[an]] the average load; 
(a'3) if it is time to recalculate the average load in the step (a'2), calculating a new 
average load by using (i) a previous average load and £ii) a current average load based on the total 
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packet size , and then proceeding to the step (b') if it is time to recalculate the average load in the 

(a'4) performing an STT service queue determination algorithm based on the load of the 
ST-T if it is not time to recalculate the average load , proceeding to the step (b') or subsequent to 
executing the step (a'3) . 

12. (currently amended) The method of claim 11, wherein the packet information 
includes a packet size, a packet arrival time, and an STT a queue information table index and a 
corresponding to STTr. 

13. (currently amended) The method of claim 9, wherein the step (b') further includes 
the steps of: 

(bT) setting die an STT service queue associated with STT r of a received packet to be 
[[a]] the low-priority queue if the calculated average load of STTr an STT load of the received 
packet is greater than an allowable load when the high-priority queue is in a congested state; 

(b'2) randomly choosing one STT (STTs), which uses the using a low-priority queue : 
from the queue information table if the service queue associated with STTr is the of the STT 
corresponding to the received packet is a high-priority queue; 

(b'3) following the step (b'2), setting a an STT service queue associated with STT s ef-a 
low load to be [[a]] the high-priority queue and the service queue associated with STTr an STT 
service queue of a high load to be [[a]] the low-priority queue if [[an]] the average load of STTr an 
STT corresponding to the received packet is greater than that of the randomly chosen STTs; 

(b'4) randomly choosing one STT (STT s ), which uses the using a high-priority queue,, 
from the queue information table if the service queue associated with STTr of the STT 
corresponding to the received packet is a is the low-priority queue; and 

(b'5) following the step (b'4), setting an STT service queue of a low load the service 
queue associated with STTr to be [[a]] the high-priority queue and a service queue associated with 
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STTs the STT service queue of a high load to be [[a]] the low-priority queue if [[an]] the average 
load of STTr an STT corresponding to the received packet is smaller than that of the randomly 

14. (currently amended) The method of claim 9, wherein the step (c 1 ) further includes 
the steps of: 

(c'l) determining whether the an STT service queue associated with STTr after the 
selective resetting in the step (b') is the high-priority queue or the low-priority queue based on a 
load of an STT ; 

(c'2) calculating a total packet size served through [[a]] the high-priority queue if the 
service queue associated with STTr is the used by the received packet is a high-priority queue; 

(c'3) calculating [[an]] the average load of [[a]] the high-priority queue if it is time to 
recalculate a load the average load of the high-priority queue ; and 

(c'4) proceeding to the step (d'). resetting a certain STT service queue based on the load 
of the high priority queue; and 

{ety storing modified STT information in the queue information table. 

15. (currently amended) The method of claim 9, wherein the step (d') includes the 
steps of: 

(d'l) obtaining the calculated calculating an average load of [[a]] the high-priority queue 
from the step (c') ; 

(d'2) randomly choosing one STT , which uses the using a high-priority queue,, and setting 
a service queue of the randomly chosen STT to the low-priority queue if the calculated average load 
of the high-priority queue indicates that the high-priority queue is in a congested state; 

(d'3) randomly choosing one ST T, which uses the using a low-priority queue^ and setting 
a service queue of the randomly chosen STT to the high-priority queue if the calculated average 
load of the high-priority queue indicates that the high-priority queue is in an idle state; and 
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(d'4) proceeding to the step (e') storing modified STT information in the queue 
information table if the calculated average load of the high-priority queue indicates that the high- 
priority queue is in a stable state or when one of the steps of (d'2) and (d'3) [[are]] is performed. 

16. (new) The method of claim 7, wherein the step (f) comprises the following steps 
performed by the queue coordinator: 

(a') calculating an average load of STT R based on the packet information transferred 
from the packet classifier; 

(b') selectively resetting the service queue associated with STT R depending on the 
calculated average load of STT R ; and 

(c') storing the selectively reset service queue in the queue information table. 

17. (new) The method of claim 16, wherein the step (b') further includes the steps of: 
(b'l) setting the service queue associated with STT R to be the low -priority queue if the 

calculated average load of STT R is greater than an allowable load when the high-priority queue is in 
a congested state; 

(b'2) randomly choosing one STT (STT S ), which uses the low-priority queue, from the 
queue information table if the service queue associated with STT R is the high-priority queue; 

(b'3) following the step (b'2), setting a service queue associated with STT S to be the 
high-priority queue and the service queue associated with STT R to be the low-priority queue if the 
average load of STT R is greater than that of STT S ; 

(b'4) randomly choosing one STT (STT S ), which uses the high-priority queue, from the 
queue information table if the service queue associated with STT R is the low-priority queue; and 

(b'5) following the step (b'4), setting the service queue associated with STT R to be the 
high-priority queue and a service queue associated with STT S to be the low-priority queue if the 
average load of STT R is smaller than that of STT S . 
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18. (new) The method of claim 17, wherein the step (f) further comprises the following 
steps performed by the queue coordinator after the steps (a') and (b') and before the step (c'): 

(d) calculating an average load of the high-priority queue; and 

(e') selectively resetting a service queue associated with a certain STT depending on the 
calculated average load of the high-priority queue. 

19. (new) The method of claim 18, wherein the step (e') includes the steps of: 

(e' 1) obtaining the calculated average load of the high-priority queue from the step (d'); 

(e'2) randomly choosing one STT, which uses the high-priority queue, and setting a 
service queue of the randomly chosen STT to the low-priority queue if the calculated average load 
of the high-priority queue indicates that the high-priority queue is in a congested state; 

(e'3) randomly choosing one STT, which uses the low-priority queue, and setting a 
service queue of the randomly chosen STT to the high-priority queue if the calculated average load 
of the high-priority queue indicates that the high-priority queue is in an idle state; and 

(e'4) proceeding to the step (c') if the calculated average load of the high-priority queue 
indicates that the high-priority queue is in a stable state or when one of the steps of (e'2) and (e'3) is 
performed. 

20. (new) The method of claim 19, wherein the step (d') further includes the steps of: 
(d'l) determining whether the service queue associated with STT R after the selective 

resetting in the step (b') is the high-priority queue or the low-priority queue; 

(d'2) calculating a total packet size served through the high-priority queue if the service 
queue associated with STT R is the high-priority queue; 

(d'3) calculating the average load of the high-priority queue if it is time to recalculate the 
average load of the high-priority queue; and 

(d'4) proceeding to the step (e'). 
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